HTTP authentication

Anon

Hi!

This is not really a PHP question, but... I'm trying to get a page protected via normal HTTP authentication. However, I don't understans how things work. Like this example (written from scratch, so there might be errors):

if (!(isset ($PHP_AUTH_NAME) && isset ($PHP_AUTH_PW)))
{
header ("WWW-Authentication: Basic-realm=\"Private\"");
header ("HTTP/1.0 401 Unauthorized');
echo 'Authorization Required.';
exit;
}

Is the first header received by the browser, then the login dialog displayed, or is the whole script executed past this, and then the dialog displayed? And where does the code jump to if I press Cancel, or write a correct login? Is the page automagically reloaded? This seems a bit to magical for me...

Anon

Use this as an include file on top of the pages you want protected.

<? // Index site created 11/18/00

				if(!isset($PHP_AUTH_USER)) {
	  	Header("WWW-authenticate: basic realm=\"Restricted Area\"");
		  Header( "HTTP/1.0 401 Unauthorized");
		  echo "<FONT SIZE=6 COLOR=\"#804040\" FACE=\"Arial\"><B>Authorization Required</B></FONT><BR><BR>

This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.
<HR SIZE=1 WIDTH=640 ALIGN=\"left\" NOSHADE>
Apache/1.3.9 Server Port 80";
exit;
} else if (isset($PHP_AUTH_USER)) {
if (($PHP_AUTH_USER != "username") || ($PHP_AUTH_PW != "password")) {
Header("WWW-authenticate: basic realm=\"Restricted Area\"");
Header( "HTTP/1.0 401 Unauthorized");
echo "Authorization Required 
This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.
<HR SIZE=1 WIDTH=640 ALIGN=\"left\" NOSHADE>
Apache/1.3.9 Server at Port 80";
exit;
} else {
// set additional cose if ness
}
}
?>

Hope this helps see the manual for more detail... :0

Anon

Thanks, but what I was after was understanding. I can get it to work, but I want to know how and why it works... So please, have a look at the original message, and try to answer one or two of the questions.

Anon

well, for this method, i had tried it out but it doesn't work as i kept getting the Internal Server Error message. i am running apache server under windows nt and i even tried the .htaccess and .htpasswd file method but still of no use.

for your question above, the code segment is forcing the apache server to pop up a login window if the $PHP_AUTH_NAME have no value thus permitting only those with username and password to enter the protected site.

Anon

Sorry to say it, but that doesn't answer any of my questions. I know how an if-statement works, I'm not a newbie...

"Is the first header received by the browser, then the login dialog displayed, or is the whole script executed past this, and then the dialog displayed?"
"And where does the code jump to if I press Cancel, or write a correct login? Is the page automagically reloaded?"

Anon

The first header is received, then the dialog box is displayed. PHP only loads one section at a time and it will go in order by include files, ie. header, footer, whatever. If you press cancel, the page goes here:

echo 'Authorization Required.';

If you were to write a correct login it would be sent nowhere by the code you have written, but it would eventually be linked in an if else statement saying fopen(www.whatever.com)

Hope this helps.

Anders Ohrt wrote:

Sorry to say it, but that doesn't answer any of my questions. I know how an if-statement works, I'm not a newbie...

"Is the first header received by the browser, then the login dialog displayed, or is the whole script executed past this, and then the dialog displayed?"
"And where does the code jump to if I press Cancel, or write a correct login? Is the page automagically reloaded?"

Anon

Hi!

Lets see if I've gotten this right then.
The first header is sent ("WWW-auth.."), and PHP then waits for the browser to reply... If I press cancel it continues the script where it is and sends the 401-header, echoes and exits?
But what if I write something and presses OK? Where does the script go then? Does it break out of the if-statement, and continues after that?

Anon

Hi,

no, it doesn't "jump out" out of the if-loop but it refreshes the page with the variables $PHP_AUTH_USER and $PHP_AUTH_PW (and $PHP_AUTH_TYPE) set - as written in your PHP Manual 😉